Since you have overrided the default name of security element (which is "default") with "service-security", I guess you should add the attribute sy:security="service-security" to the component service ServiceA. Then it will correctly refer to the security element with that name. Or just remove name="service-security" form the security element. See doc: Security - SwitchYard - Project Documentation Editor